Cited by 183IoT and Edge/Fog ComputingNetwork Security and Intrusion DetectionInternet of Things and AI

Consumer, Commercial, and Industrial IoT (In)Security: Attack Taxonomy and Case Studies

Open access
Xenofontos, Christos, Zografopoulos, Ioannis, Konstantinou, Charalambos, Jolfaei, Alireza, Khan, Muhammad Khurram, Choo, Kim-Kwang Raymond·2022·IEEE Internet of Things Journal

Abstract

Internet of Things (IoT) devices are becoming ubiquitous in our lives, with applications spanning from theconsumerdomain tocommercialandindustrialsystems. The steep growth and vast adoption of IoT devices reinforce the importance of sound and robust cybersecurity practices during the device development life cycles. IoT-related vulnerabilities, if successfully exploited can affect, not only the device itself but also the application field in which the IoT device operates. Evidently, identifying and addressing every single vulnerability are an arduous, if not impossible, task. Attack taxonomies can assist in classifying attacks and their corresponding vulnerabilities. Security countermeasures and best practices can then be leveraged to mitigate threats and vulnerabilities before they emerge into catastrophic attacks and ensure overall secure IoT operation. Therefore, in this article, we provide an attack taxonomy, which takes into consideration the different layers of the IoT stack, i.e., device, infrastructure, communication, and service, and each layer’s designated characteristics, which can be exploited by adversaries. Furthermore, using nine real-world cybersecurity incidents that had targeted IoT devices deployed in the consumer, commercial, and industrial sectors, we describe the IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and potential mitigation mechanisms and protection strategies. These (and many other) incidents highlight the underlying security concerns of IoT systems and demonstrate the potential attack impacts of such connected ecosystems, while the proposed taxonomy provides a systematic procedure to categorize attacks based on the affected layer and corresponding impact.

Integrity signals

Registry

Crossref · 10.1109/jiot.2021.3079916

Cites

76 of 76 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

Flagged first, then by citations

1 of the 77 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Xenofontos, C., Zografopoulos, I., Konstantinou, C., Jolfaei, A., Khan, M. K., & Choo, K.-K. R.
Affiliations
  • Florida State University (US)
  • Macquarie University (AU)
  • King Saud University (SA)
  • University of South Australia (AU)
Venue
IEEE Internet of Things Journal
Published
2022-01-01
Volume
9
Issue
1
Pages
199-221
ISSN
  • 2327-4662 (ISSN-L)
  • 2372-2541
OpenAlex
W3160751182
Cited by
183
References
77
Citations by year
2026: 30 · 2025: 41 · 2024: 38 · 2023: 37 · 2022: 27 · 2021: 10
FWCI
12.56
Type
journal article
Language
en
Open access
Locations
  • IEEE Internet of Things Journal (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, public-domain)
  • Adelaide Research & Scholarship (AR&S) (University of Adelaide) (submittedVersion, public-domain)
  • arXiv (Cornell University) (submittedVersion)
  • King Abdullah University of Science and Technology Repository (King Abdullah University of Science and Technology) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Science Foundation
  • U.S. Department of Defense
  • National Aeronautics and Space Administration
  • University of Texas at San Antonio
  • National Security Agency
  • Government of South Australia
  • Australian Government
  • auDA Foundation
  • National Drug Law Enforcement Research Fund
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
Keywords
Internet of Things security, attack taxonomy, IoT vulnerabilities, consumer IoT, Industrial Internet of Things, cyber incidents, vulnerability exploitation, security countermeasures

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review